Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
24/01/2023, 00:52
General
- Target file.exe
- Size 336KB
- Sample230124-a73cbsgb69
- SHA256 e18d023806b2dae4cfae65f12e8a663caaa310eac3a9fb4d0efdcd0316fee55b
Malware Config
Extracted
-
vidar
-
2.2
-
237
-
https://t.me/litlebey
-
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 6 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 3 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BB36.exeC:\Users\Admin\AppData\Local\Temp\BB36.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 10282⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\BE16.exeC:\Users\Admin\AppData\Local\Temp\BE16.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 18922⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\BFCC.exeC:\Users\Admin\AppData\Local\Temp\BFCC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3729\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_3729\Engine.exe /TH_ID=_2692 /OriginExe="C:\Users\Admin\AppData\Local\Temp\BFCC.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeC:\Windows\system32\CmD.exe /c cmd < 413⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode 7 7JkSB5⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^McNZguVzMAVMcaKBMuiboIAzlxCLPYBWVnkTamWIVDZgkhwKXHhleSstUzPUDlEOZYQXuRpjpmBFIkiWaROiLdUriuYYJeyLYkgjvrDyn$" 7JkSB5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\3538\Private.exe.pif3538\\Private.exe.pif 3538\\D5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe6⤵
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 85⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 220 -ip 2201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1156 -ip 11561⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
powershell.exe.log
StartupProfileData-NonInteractive
BB36.exe
BB36.exe
BE16.exe
BE16.exe
BFCC.exe
BFCC.exe
00000#07
00001#41
00002#7
Engine.exe
Engine.exe
Modern_Icon.bmp
Setup.txt
Private.exe.pif
Private.exe.pif
7JkSB
svcupdater.exe
svcupdater.exe
memory/220-177-0x0000000000400000-0x000000000046D000-memory.dmp
memory/220-160-0x0000000001FF0000-0x0000000002037000-memory.dmp
memory/220-159-0x00000000006ED000-0x0000000000717000-memory.dmp
memory/220-176-0x00000000006ED000-0x0000000000717000-memory.dmp
memory/220-163-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1156-214-0x00000000772A0000-0x0000000077443000-memory.dmp
memory/1156-151-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-150-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-155-0x00000000772A0000-0x0000000077443000-memory.dmp
memory/1156-148-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-149-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-147-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-156-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-153-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-191-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-204-0x00000000772A0000-0x0000000077443000-memory.dmp
memory/1156-143-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-152-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-213-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-209-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-154-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-157-0x0000000000970000-0x0000000000DF9000-memory.dmp
memory/1156-181-0x0000000060900000-0x0000000060992000-memory.dmp
memory/1192-223-0x0000000000400000-0x0000000000558000-memory.dmp
memory/1192-222-0x0000000000400000-0x0000000000558000-memory.dmp
memory/1192-165-0x0000000000400000-0x0000000000558000-memory.dmp
memory/1648-207-0x0000000006190000-0x00000000061B2000-memory.dmp
memory/1648-179-0x0000000004F50000-0x0000000004FB6000-memory.dmp
memory/1648-206-0x0000000006140000-0x000000000615A000-memory.dmp
memory/1648-208-0x0000000007480000-0x0000000007A24000-memory.dmp
memory/1648-187-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/1648-180-0x0000000005030000-0x0000000005096000-memory.dmp
memory/1648-205-0x0000000006E30000-0x0000000006EC6000-memory.dmp
memory/1648-178-0x0000000004DB0000-0x0000000004DD2000-memory.dmp
memory/1648-175-0x0000000005110000-0x0000000005738000-memory.dmp
memory/1648-174-0x0000000002310000-0x0000000002346000-memory.dmp
memory/3552-136-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3552-135-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3552-134-0x00000000005D0000-0x00000000005D9000-memory.dmp
memory/3552-133-0x0000000000460000-0x0000000000560000-memory.dmp
memory/3652-226-0x000000000083C000-0x0000000000866000-memory.dmp
memory/3652-227-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3652-229-0x000000000083C000-0x0000000000866000-memory.dmp